better-supabase 0.8.0 → 0.9.0

package/dist/session-ChiXDZdZ.d.ts

@@ -1,72 +0,0 @@
-import { CookieOptions } from "@supabase/ssr";
-//#region src/auth/session.d.ts
-/**
- * The session object auth-js persists (`sb-<ref>-auth-token`). A
- * `tokens-only` cookie has no `user`: auth-js keeps it in `auth.userStorage`.
- */
-interface StoredSession {
-  readonly access_token: string;
-  readonly refresh_token: string;
-  readonly expires_at?: number;
-  readonly expires_in?: number;
-  readonly token_type?: string;
-  readonly user?: unknown;
-  readonly [key: string]: unknown;
-}
-/**
- * `cookies.encode` in `@supabase/ssr`: `user-and-tokens` stores the user
- * object in the cookie, `tokens-only` stores the access and refresh tokens
- * alone. The server and the browser client must use the same value.
- */
-type SessionEncoding = "user-and-tokens" | "tokens-only";
-declare const DEFAULT_SESSION_ENCODING: SessionEncoding;
-interface WriteSessionOptions {
-  /** Defaults to `user-and-tokens`, the `@supabase/ssr` default. */
-  readonly encode?: SessionEncoding;
-}
-/** A cookie scope an earlier deploy wrote the session at. */
-interface CookieScope {
-  readonly domain?: string;
-  readonly path?: string;
-}
-interface CookieRecord {
-  readonly name: string;
-  readonly value: string;
-}
-interface CookieWrite {
-  readonly name: string;
-  readonly value: string;
-  readonly options: CookieOptions;
-}
-/** Headers that keep responses carrying session cookies out of shared caches. */
-declare const AUTH_CACHE_HEADERS: Readonly<Record<string, string>>;
-/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
-declare function sessionCookieName(url: string): string;
-declare function parseCookies(header: string | null | undefined): CookieRecord[];
-declare function serializeCookie(write: CookieWrite): string;
-/**
- * Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
- * chunked, `user-and-tokens` or `tokens-only`). Mismatched chunks from a
- * partial write read as no session.
- */
-declare function readSession(cookies: readonly CookieRecord[], name: string): StoredSession | null;
-/** The encoding a stored session was written with: `tokens-only` without a `user`. */
-declare function sessionEncoding(session: StoredSession): SessionEncoding;
-/**
- * Cookie writes that store `session` (or clear it with `null`) exactly like
- * `@supabase/ssr` with the same `encode`, and expire chunks the new value no
- * longer uses.
- */
-declare function writeSession(existing: readonly CookieRecord[], name: string, session: StoredSession | null, options?: CookieOptions, { encode }?: WriteSessionOptions): CookieWrite[];
-/**
- * `Max-Age=0` writes for every chunk of the session cookie at each of
- * `scopes`, like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once
- * the cookie `domain` or `path` changed, for the scopes earlier deploys
- * wrote: browsers ignore writes for scopes the host doesn't own, but a scope
- * equal to the current one clears the live session.
- */
-declare function clearSessionAtScopes(existing: readonly CookieRecord[], name: string, scopes: readonly CookieScope[]): CookieWrite[];
-/** Applies cookie writes to a cookie list, as the next request would see it. */
-declare function applyCookieWrites(cookies: readonly CookieRecord[], writes: readonly CookieWrite[]): CookieRecord[];
-//#endregion
-export { writeSession as _, CookieWrite as a, StoredSession as c, clearSessionAtScopes as d, parseCookies as f, sessionEncoding as g, sessionCookieName as h, CookieScope as i, WriteSessionOptions as l, serializeCookie as m, CookieOptions as n, DEFAULT_SESSION_ENCODING as o, readSession as p, CookieRecord as r, SessionEncoding as s, AUTH_CACHE_HEADERS as t, applyCookieWrites as u };

package/dist/shared-CBxosKK3.js

@@ -1,75 +0,0 @@
-import { pipeline, seedContext } from "@supabase/middleware";
-//#region src/bridges/shared.ts
-/** The string keys of a pipeline context: every contribution, without the seed's symbols. */
-function contributionsOf(ctx) {
-	const contributions = {};
-	for (const [key, value] of Object.entries(ctx)) contributions[key] = value;
-	return contributions;
-}
-/** The per-request value a bridge seeds under `key`. */
-function handoffOf(ctx, key) {
-	return ctx[key];
-}
-/**
-* Makes the body of `request` readable more than once, in place: the first
-* reader drains the stream into a cache and later readers are served from
-* it, so an entry and the route both see the body. For frameworks that hand
-* the route the same `Request` the middleware saw (TanStack Start,
-* SvelteKit, React Router), where `bufferRequest`'s wrapped copy can't go.
-*/
-function bufferInPlace(request) {
-	if (!request.body || request.bodyUsed) return;
-	const readOnce = request.arrayBuffer.bind(request);
-	let buffer;
-	const arrayBuffer = () => buffer ??= readOnce();
-	const text = async () => new TextDecoder().decode(await arrayBuffer());
-	const readers = {
-		arrayBuffer,
-		text,
-		json: async () => JSON.parse(await text()),
-		bytes: async () => new Uint8Array(await arrayBuffer()),
-		blob: async () => new Blob([await arrayBuffer()]),
-		formData: async () => new Response(await arrayBuffer(), { headers: request.headers }).formData(),
-		clone: () => request
-	};
-	for (const [name, value] of Object.entries(readers)) Object.defineProperty(request, name, {
-		value,
-		configurable: true
-	});
-}
-const DOWNSTREAM = Symbol("bridge.downstream");
-/**
-* The shared shape of the upstream bridges: the pipeline folds once, each
-* request seeds the framework's `next` under a symbol, and the terminal
-* hands it the contributions, so response-phase entries see the
-* framework's response. `platform` is the host's env object, if any, which
-* `getEnv` reads first.
-*/
-function around(entries) {
-	const run = pipeline(entries, (_request, ctx) => handoffOf(ctx, DOWNSTREAM)(contributionsOf(ctx)));
-	return (request, platform, downstream) => run(request, {
-		...seedContext(platform),
-		[DOWNSTREAM]: downstream
-	});
-}
-/**
-* A framework handler's value as a `Response`: responses as is, `undefined`
-* as 204, other values as JSON. `init` carries the status and headers the
-* handler set on the framework's response object.
-*/
-function toResponse(value, init = {}) {
-	if (value instanceof Response) return value;
-	const options = {
-		...init.status === void 0 ? {} : { status: init.status },
-		...init.statusText === void 0 ? {} : { statusText: init.statusText },
-		...init.headers === void 0 ? {} : { headers: init.headers }
-	};
-	if (value === void 0 || value === null) return new Response(null, {
-		status: 204,
-		...options
-	});
-	if (typeof value === "string") return new Response(value, options);
-	return Response.json(value, options);
-}
-//#endregion
-export { toResponse as i, bufferInPlace as n, handoffOf as r, around as t };

package/dist/shared-DHjhfRdV.js

@@ -1,60 +0,0 @@
-import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-2M6CKMP4.js";
-//#region src/plugins/shared.ts
-/** Database column name for an app column, or `undefined` if it is unknown. */
-function dbName(table, app) {
-	return app === void 0 ? void 0 : table.columns[app]?.db;
-}
-function isNull(column) {
-	return {
-		kind: "column",
-		column,
-		op: "is",
-		value: null
-	};
-}
-function isNotNull(column) {
-	return {
-		kind: "not",
-		item: isNull(column)
-	};
-}
-function equals(column, value) {
-	return {
-		kind: "column",
-		column,
-		op: "eq",
-		value
-	};
-}
-/** Sets `column` on a row unless the caller already provided it. */
-function withDefault(row, column, value) {
-	if (column === void 0 || column in row) return row;
-	return {
-		...row,
-		[column]: value
-	};
-}
-/**
-* Refuses caller-supplied values for columns a plugin fills (timestamps,
-* actor, soft delete) unless the call passes `{ override: true }`. Returns
-* whether the caller may keep its own values.
-*/
-function guardManaged(op, columns, plugin, options) {
-	if (options["override"] === true) return true;
-	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
-	for (const column of columns) {
-		if (column === void 0) continue;
-		if (rows.some((row) => column in row)) throw new DbException(dbError("invalid_request", `"${column}" on ${op.table.key} is filled by ${plugin}(); pass { override: true } to set it yourself`, { table: op.table.key }));
-	}
-	return false;
-}
-/** Upserts that may update existing rows must not overwrite "created" columns. */
-function insertsOnly(op) {
-	return !op.onConflict || op.onConflict.action === "ignore";
-}
-function forbidden(message) {
-	throw new DbException(dbError("forbidden", message));
-}
-//#endregion
-export { insertsOnly as a, withDefault as c, guardManaged as i, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t };

package/dist/shared-DTneRoxi.js

@@ -1,14 +0,0 @@
-import { n as invalidRequest } from "./build-meLuYGri.js";
-//#region src/compile/shared.ts
-/** A row-count or offset value that is safe to inline into SQL text. */
-function integer(value) {
-	if (!Number.isInteger(value) || value < 0) invalidRequest(`Expected a non-negative integer, got ${value}`);
-	return value;
-}
-/** The ` where a and b` clause for the parts that are present, or an empty string. */
-function whereClause(parts) {
-	const present = parts.filter((part) => part !== void 0);
-	return present.length > 0 ? ` where ${present.join(" and ")}` : "";
-}
-//#endregion
-export { whereClause as n, integer as t };

package/dist/sign-in-D_yoP0PF.js

@@ -1,86 +0,0 @@
-import { n as ClientContext } from "./hooks-Bhza9Hnr.js";
-import { useContext, useMemo, useRef, useState } from "react";
-//#region src/react/sign-in.ts
-function useAuthApi(options, hook) {
-	const context = useContext(ClientContext);
-	const auth = options.client?.auth ?? context?.client.supabase.auth;
-	if (!auth) throw new Error(`better-supabase: ${hook} needs <BetterSupabaseProvider client={bs}> or { client: supabase }`);
-	return auth;
-}
-/** Runs auth calls with `pending` and `error` state; the latest call owns the state. */
-function usePending(options) {
-	const [state, setState] = useState({
-		pending: false,
-		error: void 0
-	});
-	const latest = useRef({
-		call: 0,
-		options
-	});
-	latest.current.options = options;
-	return {
-		state,
-		run: useMemo(() => async (call) => {
-			latest.current.call += 1;
-			const id = latest.current.call;
-			setState({
-				pending: true,
-				error: void 0
-			});
-			let error;
-			try {
-				({error} = await call());
-			} catch (cause) {
-				if (id === latest.current.call) setState({
-					pending: false,
-					error: void 0
-				});
-				throw cause;
-			}
-			if (id === latest.current.call) setState({
-				pending: false,
-				error: error ?? void 0
-			});
-			if (!error) latest.current.options.onSuccess?.();
-			return error ?? void 0;
-		}, [])
-	};
-}
-/**
-* Sign-in calls with `pending` and `error` state. The session lands in the
-* client's auth store, so `useAuth()` updates on its own.
-*
-* ```tsx
-* const signIn = useSignIn({ onSuccess: () => router.push('/') });
-* <button disabled={signIn.pending} onClick={() => signIn.password({ email, password })} />
-* ```
-*/
-function useSignIn(options = {}) {
-	const auth = useAuthApi(options, "useSignIn");
-	const { state, run } = usePending(options);
-	const calls = useMemo(() => ({
-		password: (credentials) => run(() => auth.signInWithPassword({ ...credentials })),
-		otp: (credentials) => run(() => auth.signInWithOtp(credentials)),
-		verifyOtp: (params) => run(() => auth.verifyOtp(params)),
-		oauth: (provider, oauthOptions) => run(() => auth.signInWithOAuth(oauthOptions ? {
-			provider,
-			options: oauthOptions
-		} : { provider }))
-	}), [auth, run]);
-	return {
-		...state,
-		...calls
-	};
-}
-/** `auth.signOut()` with `pending` and `error` state. The provider clears cached queries. */
-function useSignOut(options = {}) {
-	const auth = useAuthApi(options, "useSignOut");
-	const { state, run } = usePending(options);
-	const signOut = useMemo(() => (signOutOptions) => run(() => auth.signOut(signOutOptions ? { ...signOutOptions } : void 0)), [auth, run]);
-	return {
-		...state,
-		signOut
-	};
-}
-//#endregion
-export { useSignIn as n, useSignOut as r, usePending as t };

package/dist/signatures-BRS_p3WD.d.ts

@@ -1,34 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { f as Result } from "./result-BchM1XZn.js";
-//#region src/core/signatures.d.ts
-interface VerifiedWebhook<T = unknown> {
-  readonly id: string;
-  readonly timestamp: Temporal.Instant;
-  readonly payload: T;
-  readonly body: string;
-}
-interface VerifyOptions {
-  /** Allowed clock skew in seconds. Defaults to 300. */
-  readonly tolerance?: number;
-  readonly now?: () => Temporal.Instant;
-}
-type WebhookInput = Request | {
-  readonly headers: Headers | Readonly<Record<string, string>>;
-  readonly body: string;
-};
-/** Headers for a signed Standard Webhooks request. */
-declare function signWebhook(secret: string, message: {
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp?: Temporal.Instant;
-}): Promise<Record<string, string>>;
-/**
- * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
- * `webhook-signature`, or the `svix-` names Svix-based senders use) and
- * parses the JSON body. Pass several secrets while rotating.
- */
-declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
-/** Checks a shared-secret header (database webhooks), in constant time. */
-declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
-//#endregion
-export { verifySharedSecret as a, signWebhook as i, VerifyOptions as n, verifyWebhook as o, WebhookInput as r, VerifiedWebhook as t };

package/dist/signatures-DsWv_bYR.js

@@ -1,103 +0,0 @@
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { c as optionalTemporal, s as nowInstant } from "./temporal-BJGitm-h.js";
-import { n as temporalMissing } from "./temporal-required-BtynQtM-.js";
-import { a as ok, r as err } from "./result-DEqHCMKP.js";
-import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
-import { r as timingSafeEqual, t as encoder } from "./hmac-DCud0myt.js";
-//#region src/core/signatures.ts
-/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
-function secretBytes(secret) {
-	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
-	try {
-		return fromBase64(raw);
-	} catch {
-		throw new TypeError("Webhook secret is not valid base64");
-	}
-}
-/** Secrets come from configuration, so a handful of keys suffice. */
-const keys = /* @__PURE__ */ new Map();
-function keyFor(secret) {
-	let key = keys.get(secret);
-	if (!key) {
-		key = crypto.subtle.importKey("raw", secretBytes(secret), {
-			name: "HMAC",
-			hash: "SHA-256"
-		}, false, ["sign", "verify"]);
-		if (keys.size < 16) {
-			keys.set(secret, key);
-			key.catch(() => keys.delete(secret));
-		}
-	}
-	return key;
-}
-async function signature(secret, content) {
-	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
-}
-function decodeSignature(value) {
-	try {
-		return fromBase64(value);
-	} catch {
-		return;
-	}
-}
-function header(headers, name) {
-	if (headers instanceof Headers) return headers.get(name);
-	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
-}
-const unauthorized = (code, message) => dbError("unauthorized", message, { code });
-/** Headers for a signed Standard Webhooks request. */
-async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
-	return {
-		"webhook-id": message.id,
-		"webhook-timestamp": timestamp,
-		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
-	};
-}
-/**
-* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
-* `webhook-signature`, or the `svix-` names Svix-based senders use) and
-* parses the JSON body. Pass several secrets while rotating.
-*/
-async function verifyWebhook(input, secrets, options = {}) {
-	const headers = input.headers;
-	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
-	const id = header(headers, `${prefix}-id`);
-	const timestamp = header(headers, `${prefix}-timestamp`);
-	const signatures = header(headers, `${prefix}-signature`);
-	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
-	const seconds = Number(timestamp);
-	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return err(temporalMissing());
-	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
-	const tolerance = options.tolerance ?? 300;
-	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
-	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
-	const body = input instanceof Request ? await input.text() : input.body;
-	const content = encoder.encode(`${id}.${timestamp}.${body}`);
-	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).flatMap(([, value]) => decodeSignature(value) ?? []);
-	let valid = false;
-	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const key = await keyFor(secret);
-		for (const candidate of offered) if (await crypto.subtle.verify("HMAC", key, candidate, content)) valid = true;
-	}
-	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
-	try {
-		return ok({
-			id,
-			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
-			payload: JSON.parse(body),
-			body
-		});
-	} catch {
-		return err(dbError("invalid_request", "Webhook body is not JSON"));
-	}
-}
-/** Checks a shared-secret header (database webhooks), in constant time. */
-function verifySharedSecret(request, secret, headerName = "authorization") {
-	const token = (request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, "");
-	return timingSafeEqual(token, secret);
-}
-//#endregion
-export { verifyWebhook as a, verifySharedSecret as i, signWebhook as n, unauthorized as r, header as t };

package/dist/signers-cpdmZYrv.d.ts

@@ -1,166 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
-//#region src/blocks/webhooks/url-policy.d.ts
-/**
- * Decides whether a webhook may be sent to `url`. Throwing means the check
- * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
- * throws `UrlCheckError`.
- */
-type AllowUrl = (url: URL) => boolean | Promise<boolean>;
-/** The addresses a host name resolves to. */
-type ResolveHost = (hostname: string) => Promise<readonly string[]>;
-interface PublicUrlOptions {
-  /**
-   * Resolves host names so each address can be checked. Defaults to
-   * `node:dns` where the runtime has it (Node, Bun, Deno); pass one on other
-   * runtimes, or `false` to check only the URL.
-   */
-  readonly resolve?: ResolveHost | false;
-  /** Allow `http:` URLs, e.g. for local development. */
-  readonly allowHttp?: boolean;
-  /** Host names that skip every check, e.g. an internal receiver you trust. */
-  readonly allowHosts?: readonly string[];
-}
-/**
- * Whether an IP address is reachable on the public internet: not loopback,
- * private, link-local (cloud metadata), carrier-grade NAT, multicast or
- * reserved. Returns `false` for anything that isn't an IP address.
- */
-declare function isPublicAddress(address: string): boolean;
-/**
- * The default `allowUrl`: HTTPS only, no credentials in the URL, no local
- * host names, and every address the host resolves to must be public. The
- * delivery transport calls it again for each redirect.
- *
- * DNS can change between this check and the connection. Route webhooks
- * through an egress proxy when that matters.
- */
-declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
-//#endregion
-//#region src/blocks/webhooks/http.d.ts
-interface WebhookRequest {
-  readonly url: string;
-  readonly headers: Readonly<Record<string, string>>;
-  readonly body: string;
-  readonly signal?: AbortSignal;
-}
-interface WebhookResponse {
-  readonly status: number;
-  readonly body: string;
-  /** Seconds from the `Retry-After` header, when the receiver sent one. */
-  readonly retryAfter?: number;
-}
-/**
- * Sends one signed webhook request. Throw `WebhookPolicyError` when the
- * request must never be retried (a blocked URL); any other error retries.
- */
-interface WebhookTransport {
-  readonly apiVersion: 1;
-  readonly name: string;
-  send(request: WebhookRequest): Promise<WebhookResponse>;
-}
-/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
-declare class WebhookPolicyError extends Error {
-  override readonly name = "WebhookPolicyError";
-}
-interface FetchTransportOptions {
-  readonly fetch?: typeof fetch;
-  /** Checked before the first request and before each redirect. */
-  readonly allowUrl?: AllowUrl;
-  /**
-   * Defaults to 0: a redirect fails the delivery without a retry. Each hop
-   * you allow is checked with `allowUrl` first.
-   */
-  readonly maxRedirects?: number;
-  /** Per request. Defaults to 10 seconds. */
-  readonly timeoutMs?: number;
-  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
-  readonly maxResponseBytes?: number;
-}
-/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
-declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
-//#endregion
-//#region src/blocks/webhooks/secrets.d.ts
-interface RotateSecretOptions {
-  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
-  readonly overlap?: string;
-  /** Use this secret instead of a generated one, e.g. when migrating. */
-  readonly secret?: string;
-}
-/**
- * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a
- * column, set in `sql.modules.webhooks-out.options.secretStorage`) is the default;
- * implement it for a KMS or a secrets manager.
- */
-interface WebhookSecretStore {
-  readonly apiVersion: 1;
-  /** The live secrets of an endpoint, newest first. */
-  secrets(endpointId: string): Promise<readonly string[]>;
-  /** Creates a new secret and returns it once. */
-  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
-}
-/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
-declare function sqlSecretStore(transport: BlockTransport, options?: {
-  readonly schema?: string;
-}): WebhookSecretStore;
-//#endregion
-//#region src/blocks/webhooks/signers.d.ts
-interface WebhookSignInput {
-  /** The delivery id, the same on every retry so receivers can deduplicate. */
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp: Temporal.Instant;
-  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
-  readonly secrets: readonly string[];
-}
-/**
- * Adds the signature headers to an outgoing webhook. `standardWebhooks()`
- * is the default; `hmacSigner()` covers custom header and payload formats.
- */
-interface WebhookSigner {
-  readonly apiVersion: 1;
-  readonly name: string;
-  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
-}
-interface StandardWebhooksOptions {
-  /** Header names, for receivers that expect a prefix such as `svix-`. */
-  readonly headers?: {
-    readonly id?: string;
-    readonly timestamp?: string;
-    readonly signature?: string;
-  };
-}
-/**
- * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
- * scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
- * secret in `webhook-signature`. `verifyWebhook` checks it.
- */
-declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
-interface HmacSignerOptions {
-  readonly name?: string;
-  /** e.g. `x-acme-signature`. */
-  readonly signatureHeader: string;
-  /** Sends the epoch-seconds timestamp in this header. */
-  readonly timestampHeader?: string;
-  /** Sends the delivery id in this header. */
-  readonly idHeader?: string;
-  /** The signed text. Defaults to `${timestamp}.${body}`. */
-  readonly content?: (input: {
-    readonly id: string;
-    readonly timestamp: string;
-    readonly body: string;
-  }) => string;
-  /** Defaults to `hex`. */
-  readonly encoding?: "hex" | "base64";
-  /** Written before each signature. Defaults to `v1=`. */
-  readonly prefix?: string;
-  /** Joins the signatures of several secrets. Defaults to `,`. */
-  readonly separator?: string;
-}
-/**
- * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
- * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
- */
-declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
-//#endregion
-export { PublicUrlOptions as _, hmacSigner as a, publicUrl as b, WebhookSecretStore as c, WebhookPolicyError as d, WebhookRequest as f, AllowUrl as g, fetchTransport as h, WebhookSigner as i, sqlSecretStore as l, WebhookTransport as m, StandardWebhooksOptions as n, standardWebhooks as o, WebhookResponse as p, WebhookSignInput as r, RotateSecretOptions as s, HmacSignerOptions as t, FetchTransportOptions as u, ResolveHost as v, isPublicAddress as y };

package/dist/spec-pins-CwzDY25w.d.ts

@@ -1,44 +0,0 @@
-//#region src/core/spec-pins.d.ts
-/**
- * Versions of evolving specs and conventions the code follows. Moving a pin
- * is a minor release with a changeset (see the standards docs page).
- */
-declare const SPEC_PINS: {
-  readonly otelSemconv: "1.37.0";
-  readonly mcp: "2026-07-28";
-  /** The default OpenAPI version `createOpenApi` emits. */
-  readonly openapi: "3.1.2";
-  readonly openapi30: "3.0.4";
-  readonly openapi31: "3.1.2";
-  readonly openapi32: "3.2.1";
-  /** `src/oas.md` on the `v3.3-dev` branch of OAI/OpenAPI-Specification. */
-  readonly openapi33Preview: "aa2f6c0";
-  /** OAI sig-security discussion #50, as of this date. */
-  readonly securityProfiles: "sig-security#50@2026-05-05";
-  readonly overlay10: "1.0.0";
-  readonly overlay11: "1.1.0";
-  readonly overlay12: "1.2.0";
-  readonly arazzo10: "1.0.1";
-  readonly arazzo11: "1.1.0";
-  readonly asyncapi30: "3.0.0";
-  readonly asyncapi31: "3.1.0";
-  /** OpenID AuthZEN Authorization API, the vocabulary of `Authorizer`. */
-  readonly authzen: "1.0";
-  readonly cloudevents: "1.0.2";
-  readonly standardWebhooks: "1.0.0";
-  readonly sarif: "2.1.0";
-  readonly jsonSchema: "2020-12";
-  readonly postgrestAggregates: "12";
-  readonly serverTiming: "WD-20260407";
-  readonly stripeSyncEngine: "0.48.5";
-  readonly pgvector: "0.8";
-  readonly ocsf: "1.9.0";
-  readonly openfeature: "0.9.0";
-  readonly scim: "2.0";
-  readonly supabaseSdkCapabilities: "1.14.0";
-  readonly aiMessage: "1";
-  readonly aiSdkUiMessageStream: "v1";
-  readonly anthropicMemoryTool: "20250818";
-};
-//#endregion
-export { SPEC_PINS as t };